Formulating information systems risk management strategies through cultural theory

Abstract

Purpose -The purpose of this paper is to examine the potential of cultural theory as a tool for identifying patterns in the stakeholders' perception of risk and its effect on information system (IS) risk management. Design/methodology/approach -Risk management involves a number of human activities which are based on the way the various stakeholders perceive risk associated with IS assets. Cultural theory claims that risk perception within social groups and structures is predictable according to group and individual worldviews; therefore this paper examines the implications of cultural theory on IS risk management as a means for security experts to manage stakeholders perceptions. Findings -A basic theoretical element of cultural theory is the grid/group typology, where four cultural groups with differentiating worldviews are identified. This paper presents how these worldviews affect the process of IS risk management and suggests key issues to be considered in developing strategies of risk management according to the different perceptions cultural groups have.Research limitations/implications -The findings of this research are based on theoretical analysis and are not supported by relevant empirical research. Further research is also required for incorporating the identified key issues into information security management systems (ISMS). Originality/value -IS security management overlooks stakeholders' risk perception; for example, there is no scheme developed to understand and manage the perception of IS stakeholders. This paper proposes some key issues that should be taken into account when developing strategies for addressing the issue of understanding and managing the perception of IS stakeholders.

Security mistakes in information system deployment projects

“…(Dourish, dl Flor & Joseph 2003) (Carstens et al 2004) (Adams, Sasse & Lunt 1997) (Werlinger et al, 2009) (Veiga & Eloff 2009) (Kraemer and Carayon, 2005) (Kraemer et al, 2009) (Knapp, Marshall & Rainer 2006) (Pattinson and Anderson, 2007) (Tsohou et al, 2006). The research most closely related to the topic is described below.…”

An Exploration of Human Resource Management Information Systems Security

“…The theory is based on four major world views: fatalism, hierarchy, egalitarianism, and individualism. Tsohou, Karyda, Kokolakis, and Kiountouzis (2006) applied cultural theory to information system risk management. They suggested strategies for IS risk management, depending on an individual's cultural bias.…”

Development of a Failure Mode and Effects Analysis Based Risk Assessment Tool for Information Security

“…They are AS/NZS 4360:1999;AIRMIC, ALARM, IRM: 2002;BS 31100: 2008;BS 31100:2011 andISO 31000:2009 for generic risk; The ISO 27005:2011 was also reviewed which is specific to information security risk management. A number of risk management approaches from scholars, including Humphreys (2008), Misra et al (2007), Tsohou et al (2006), Kwok and Longley (1999), Spinellis et al (1999), Halliday et al (1996), and Baskerville (1991), were also studied and discussed. AS/NZS 4360 is a widely recognized risk management standard.…”

“…The four stages are described in terms of information security as follows (Misra et al, 2007) (Tsohou et al, 2006). The stage of initiation aims mainly to define the context of the risk management process; to set the scope of the analysis and to establish a risk management team.…”